open/ktg-plugin-marketplace
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity Actions
ktg-plugin-marketplace/plugins/llm-security/commands/ide-scan.md
Kjell Tore Guttormsen a46308b1e9 docs(llm-security): A3 honesty-sweep — 7 sitater nedtonet (critical-review §9) 
Closes A3 of v7.1.0 critical-review patch. Each rewrite preserves the underlying
claim where it is accurate but removes hype/overreach language. Historical
CHANGELOG/README version-table rows are intentionally left as-is (they document
what was claimed at the time of release, not what is true today).

Changes (CLAUDE.md, commands/ide-scan.md, knowledge/mitigation-matrix.md,
docs/security-hardening-guide.md):

- "Trustworthy scoring (BREAKING)" → "Severity-dominated risk scoring
  (v2 model, BREAKING)". Removes hype framing; describes the actual mechanism.
- "Context-aware entropy scanner" → "Rule-based entropy scanner with
  file-extension skip, 8 line-level suppression rules, and configurable policy".
  No ML/context inference; just rules.
- "1487 tests" → "1511 unit and integration tests; mutation-testing coverage
  not published". Updated count after A1+A2 (+24) and added qualifier.
- "Fully Schrems II compatible" → "Schrems II compatible in default offline
  mode. Optional OSV.dev enrichment (`supply-chain-recheck --online`)
  transmits package identifiers to a Google-operated API and is a separate
  compliance consideration." Acknowledges the OSV.dev opt-in caveat.
- "Rule of Two enforcement" → "Rule of Two detection (configurable; default
  warn; blocks on high-confidence trifectas in opt-in `block` mode; distributed
  trifectas detected but not blocked by default)". "Enforcement" implied
  block; default is warn.
- "Hardened ZIP extractor" → suffix " — no fuzz-testing results published
  to date". Caps and class-of-attacks rejected are accurate; absence of
  formal fuzz coverage now stated.
- "defense-in-depth" — preserved as framing, but quantified in
  security-hardening-guide §4: "three independent detection layers with
  documented bypass classes". Each layer named, each layer's known bypasses
  pointed to (critical-review §4 evasion arsenal).

Tests: 1511/1511 green (no behavioural change).
2026-04-29 11:52:55 +02:00

106 lines
5.3 KiB
Markdown
Raw Blame History

---
name: security:ide-scan
description: Scan installed VS Code + JetBrains (IntelliJ IDEA, PyCharm, GoLand, WebStorm, Android Studio, …) extensions/plugins for supply-chain risk, typosquats, obfuscation, and malicious patterns. Accepts Marketplace / OpenVSX / direct VSIX URLs and JetBrains Marketplace URLs.
allowed-tools: Read, Glob, Grep, Bash
model: sonnet
---
# /security ide-scan
Scan installed IDE extensions. Both families covered:
- **VS Code + forks** — Cursor, Windsurf, VSCodium, code-server, Insiders, Remote-SSH.
- **JetBrains plugins** — discovery from installed plugin dirs, URL fetch from JetBrains Marketplace. IntelliJ IDEA, PyCharm, GoLand, WebStorm, RubyMine, PhpStorm, CLion, DataGrip, RustRover, Rider, Aqua, Writerside, Android Studio. Fleet and Toolbox are excluded (different plugin model).
Runs the IDE scanner plus reused scanners (UNI, ENT, NET, TNT, MEM, SCR) per extension. Offline by default.
## Step 1: Run Scanner
Run the IDE extension scanner:
```
node <this plugin's scanners/ide-extension-scanner.mjs> [target]
```
Arguments (pass through as provided by the user):
- `[target]` — one of:
- omit, `.`, or `all` → discover all installed extensions
- absolute path to an extracted extension directory → single-scan mode
- `https://marketplace.visualstudio.com/items?itemName=<publisher>.<name>` → fetch from VS Code Marketplace
- `https://open-vsx.org/extension/<publisher>/<name>[/<version>]` → fetch from OpenVSX
- `https://example.com/path/foo.vsix` → direct VSIX download (HTTPS only)
- `https://plugins.jetbrains.com/plugin/7973-intellivue` → JetBrains Marketplace (numericId resolved to xmlId via metadata, then downloaded)
- `https://plugins.jetbrains.com/plugin/download?pluginId=com.example.plugin[&version=1.2.3]` → direct JetBrains plugin download
- GitHub repo URLs are NOT supported (would require build step)
- `--vscode-only` / `--intellij-only` — restrict discovery
- `--include-builtin` — include Microsoft builtin extensions (default: excluded)
- `--online` — enable Marketplace/OSV.dev lookups (opt-in; default: fully offline)
- `--format compact|json` — output format
- `--fail-on <severity>` — exit 1 if findings at/above severity
URL mode notes:
- Hardened ZIP extractor with caps: 50MB compressed, 500MB uncompressed, 100x expansion ratio, 10 000 entries, depth 20. No fuzz-testing results published to date.
- Rejects: zip-slip paths, symlink entries, absolute paths, drive letters, encrypted entries, ZIP64.
- TLS verified, HTTPS only, 30s timeout. Cross-host redirects rejected.
- Temp directory always cleaned up (success, error, abort).
- `meta.source` in the envelope contains `{ type: "url", kind, url, finalUrl, sha256, size, publisher, name, version }`.
Parse the JSON output. The result contains:
- `meta.scanner`, `meta.version`, `meta.target`, `meta.extensions_discovered` (per type), `meta.roots_scanned`, `meta.warnings`
- `extensions[]` — per-extension results with `id`, `version`, `type`, `publisher`, `source`, `is_builtin`, `signed`, `scanner_results` (IDE/UNI/ENT/NET/TNT/MEM/SCR), `aggregate` (counts, risk_score, risk_band, verdict), `warnings`
- `aggregate` — top-level counts, risk_score, risk_band, verdict, extensions_total, extensions_blocked, extensions_warning
## Step 2: Format Report
Present the results:
```
# IDE Extension Scan
| Field | Value |
|-------|-------|
| **Scanner** | ide-extension-scanner v[version] |
| **Target** | [target] |
| **Roots** | [comma-separated roots_scanned] |
| **Extensions** | [vscode] VS Code, [jetbrains] JetBrains |
| **Top Verdict** | [ALLOW/WARNING/BLOCK] |
| **Risk** | [risk_score]/100 ([risk_band]) |
| **Duration** | [duration_ms]ms |
## Counts
crit=[N] high=[N] medium=[N] low=[N] info=[N]
## Per-Extension Results
[One row per extension, sorted: BLOCK first, then WARNING, then ALLOW with findings]
| Extension | Version | Source | Verdict | Risk | Top Issue |
|-----------|---------|--------|---------|------|-----------|
Omit ALLOW rows with zero findings unless the user passed `--verbose`.
## Top Findings
[For each extension with verdict != ALLOW, list up to 3 findings as:
- [SEV] [SCANNER]: title — file:line — recommendation]
## Warnings
[Any top-level or per-extension `warnings` entries, if present]
```
## Step 3: Recommendations
- `aggregate.verdict === 'BLOCK'`: "One or more extensions are block-listed. Uninstall immediately — `code --uninstall-extension <id>`."
- `aggregate.verdict === 'WARNING'`: "High/medium findings detected. Review the Top Findings list. Audit suspicious extensions before continuing."
- `aggregate.verdict === 'ALLOW'` and counts.info > 0: "Extensions look clean. Info-level findings are observational only."
- `aggregate.extensions_total === 0`: "No extensions discovered. Run `code --list-extensions` to confirm, or pass a specific path."
If the user has many sideloaded (`source=vsix`) extensions: suggest re-installing from Marketplace where possible.
## Notes
- First run with no `--online` is fully offline.
- Pass a single extracted extension directory to scan just one extension.
- JetBrains plugins are additionally checked for `Premain-Class` javaagents, `application-components` lifecycle hooks, native binaries (`.so`/`.dylib`/`.dll`/`.jnilib`), long `<depends>` chains, typosquats vs top JetBrains plugins, and shaded-jar advisories (see `knowledge/ide-extension-threat-patterns.md`).
Reference in a new issue View git blame Copy permalink